| Titre | Portabilis i-diario 1.5.0 Cross Site Scripting |
|---|
| Description | ### Summary
An attacker can upload a malicious SVG file containing embedded JavaScript that is executed when the file is accessed directly. This results in Stored Cross-Site Scripting (XSS).
### Details
The `justificativas-de-falta` endpoint allows users to upload files after upload a crafted svg the XSS could be trigger when open the file.
Payload:
```
<svg xmlns="http://www.w3.org/2000/svg" fill="none">
<script>
alert("This is an XSS-POC from CVEHUNTERS");
</script>
</svg>
```
### PoC
Create the file with the payload and upload in the `justificativas-de-falta` endpoint:
After that open the file to trigger the XSS
### Impact
- Exploitation of these vulnerabilities allows an attacker to inject and store malicious JavaScript code on the server, which will be executed for all users accessing the affected pages. This malicious code can:
- Steal sensitive user information (e.g., session cookies, authentication tokens),
- Redirect users to malicious sites,
- Manipulate the application's interface, enabling phishing attacks and other social engineering techniques,
- Compromise the application's integrity, causing potentially severe impacts to user experience and security
by [CVE-Hunters](https://github.com/Sec-Dojo-Cyber-House/cve-hunters)
|
|---|
| La source | ⚠️ https://github.com/nmmorette/vulnerability-research/tree/main/idiario |
|---|
| Utilisateur | nmmorette (UID 87361) |
|---|
| Soumission | 02/07/2025 17:29 (il y a 10 mois) |
|---|
| Modérer | 19/07/2025 07:53 (17 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 316983 [Portabilis i-Diario 1.5.0 justificativas-de-falta Endpoint Anexo cross site scripting] |
|---|
| Points | 20 |
|---|